Commit 42402a89ab for ffmpeg

commit 42402a89ab938b735125a1eba3723e5b28aad583
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 02:05:55 2026 +0100

    avfilter/vsrc_mandelbrot: check the frame size before allocating the point cache

    Fixes: signed integer overflow
    Fixes: iT7bvqnOb6Qq

    Found during triage of the security report LPW4jFrf2FjP

    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/vsrc_mandelbrot.c b/libavfilter/vsrc_mandelbrot.c
index 7f9d86b1d6..564069e3bd 100644
--- a/libavfilter/vsrc_mandelbrot.c
+++ b/libavfilter/vsrc_mandelbrot.c
@@ -121,6 +121,10 @@ AVFILTER_DEFINE_CLASS(mandelbrot);
 static av_cold int init(AVFilterContext *ctx)
 {
     MBContext *s = ctx->priv;
+    int ret = av_image_check_size(s->w, s->h, 0, ctx);
+
+    if (ret < 0)
+        return ret;

     s->bailout *= s->bailout;

@@ -154,9 +158,6 @@ static int config_props(AVFilterLink *outlink)
     FilterLink *l = ff_filter_link(outlink);
     MBContext *s = ctx->priv;

-    if (av_image_check_size(s->w, s->h, 0, ctx) < 0)
-        return AVERROR(EINVAL);
-
     outlink->w = s->w;
     outlink->h = s->h;
     outlink->time_base = av_inv_q(s->frame_rate);